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Claims 

1. A control system for a load, the system comprising a first 
microprocessor having an output to drive one side of a load, a second 

5 microprocessor having an output to drive the other side of the load, the system 
being arranged so that when either microprocessor detects a fault in the control 
of the load the load is switched off. 

2. A system according to claim 1 wherein both microprocessors monitor 
1 0 the current in the load. 

3. A system according to claim 1 or 2 wherein a first resistor of relatively 
high value is connected between a driver output of the first microprocessor and 
an input of the second microprocessor, to allow the second microprocessor to 

15 monitor if the first microprocessor is attempting to turn on the load. 

4. A system according to claim 3 wherein a second resistor with a value 
less than that of the first resistor, is connected between the output of the first 
microprocessor and a low voltage to ensure a driver controlling the load is off 

20 whenever the output of the first microprocessor is in a high resistance state. 

5. A system according to any preceding claim wherein at least one of the 
microprocessors is arranged to calculate the current of the load by measuring 
the voltage across it and, when the load current does not meet pre-determined 

25 criteria, to switch out the load. 

6. A system according to any preceding claim wherein the control system 
is a vehicular control system. 
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7. A system according to any preceding claim wherein the load is a gear 
box selector, a clutch selector or a valve. 

8. A control method for a load, the method comprising a first 
5 microprocessor having an output to drive one side of a load, a second 

microprocessor having an output to drive the other side of the load, the system 
being arranged so that when either microprocessor detects a fault in the control 
of the load the load is switched off. 

10 9. A method according to claim 8 further comprising both microprocessors 
monitoring the current in the load. 

10. A method according to claim 8 or 9 wherein the second microprocessor 
is arranged to monitor if the first microprocessor is attempting to tum the load 

15 on by means of a first resistor of relatively high value between the driver output 
of the first microprocessor and an input of the second microprocessor. 

11. A method according to claim 10 wherein the first microprocessor is 
monitored by means of a second resistor with a value less than that of the first 

20 resistor, the second resistor being connected between the output of the first 
microprocessor and a low voltage to ensure the driver controlling the load is off 
whenever the output of the first microprocessor is in a high resistance state. 

.12. A method according to any of claims 8 to 1 1 further comprising at least 
25 one of the microprocessors calculating the current of the load by measuring the 
voltage across it and, when the load current does not meet pre-determined 
criteria, switching out the load. 
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13. A method according to any of claims 8 to 12 wherein the control method 
is applied to a vehicular control system. 

14. A method according to any of claims 8 to 13 wherein the load is a gear 
5 box selector, a clutch selector or a valve. 

15. A control system for a load, the system comprising a first 
microprocessor having an output to provide a drive signal to drive the load, a 
second microprocessor to monitor the operation of the first microprocessor and 

10 the operation of the load, the system being arranged so that when the second 
microprocessor detects a fault in the operation of the first microprocessor 
and/or the operation of the load, the second microprocessor is arranged to 
switch out the load or halt the operation of the first microprocessor. 

15 16. A control method for a load, the method comprising driving a load by 
means of a drive signal provided by a first microprocessor, monitoring the 
operation of the first microprocessor and the operation of the load by means of 
a second microprocessor, when the second microprocessor detects a fault in tihe 
operation of the first microprocessor and/or the operation of liie load, the 

20 second microprocessor switches out the load and/or halts the operation of the 
first microprocessor. 



